| path | Repository path to scan. | no | . |
| config-path | Optional Gitleaks-compatible config path. | no | "" |
| baseline-path | Optional Gitleaks-compatible baseline path. | no | "" |
| rule-packs | Optional comma-separated built-in rule packs. Values are picket-strict and picket-experimental. | no | "" |
| cache | Restore and save the native Picket scan cache. | no | true |
| cache-mode | Native scan cache storage mode. Use secret-hash-only for public CI safety or raw for exact cached report replay in trusted jobs. | no | secret-hash-only |
| cache-path | Native Picket scan cache directory. | no | .picket/cache |
| cache-key | Optional explicit cache key. | no | "" |
| report-directory | Directory where SARIF and JSONL reports are written. | no | picket-results |
| fail-on | Failure mode. Use findings, errors, or never. | no | findings |
| summary | Write the Picket scan job summary. | no | true |
| results | Optional comma-separated validation result states to keep before reports, annotations, and failure enforcement. | no | "" |
| only-verified | Keep only structurally valid offline findings and active live-verification findings. | no | false |
| upload-sarif | Upload the SARIF report through GitHub code scanning. | no | false |
| annotations | Emit safe GitHub workflow annotations from JSONL findings. | no | true |
| annotation-limit | Maximum number of workflow annotations to emit. | no | 50 |
| redact | Redaction percentage from 0 through 100. Defaults to full redaction for public CI safety. | no | 100 |
| max-target-megabytes | Optional maximum file size in decimal MB for content rules. | no | "" |
| timeout | Optional scan timeout in seconds. Use 0 to disable. | no | "" |
| max-archive-depth | Optional maximum nested archive traversal depth. Use 0 to disable. | no | "" |
| max-archive-entries | Optional maximum number of files extracted from archives. Use 0 to disable. | no | "" |
| max-archive-megabytes | Optional maximum decompressed archive payload in decimal MB. | no | "" |
| max-archive-ratio | Optional maximum archive expansion ratio. Use 0 to disable. | no | "" |
| dotnet-version | .NET SDK version used to run the source-based action. | no | 10.0.301 |
| setup-dotnet | Install the configured .NET SDK before running Picket. | no | true |